I don't know the context why you want to do this... I have a similar use case, in a production environment.
I have installed Traefik, a proxy usable in docker, "in front of" NodeRed. The usual 1880 port is not exposed on the host, it is only reachable via Traefik.
And, I am putting authentication on Traefik. Not on NodeRed.
It might be applicable or not. It adds another moving part though. Which in my case is no big deal as I need Traefik for other purposes.